Tema: windows
-
Kerberos on Windows: klist, klist purge, and setspn -L/-Q for SPN problems
Windows exposes cached Kerberos tickets through klist and service principal names through setspn. Duplicate SPNs and clock skew between a client and a domain controller are the two failures that most often turn into confusing 'cannot authenticate' errors rather than a clear Kerberos message.
-
UEFI boot entries and Secure Boot state on Linux and Windows
efibootmgr and bcdedit /enum firmware both read and rewrite the UEFI boot-entry list that decides what the firmware tries to start and in what order, while mokutil --sb-state and Confirm-SecureBootUEFI report whether Secure Boot is currently enforced — separate from, and a precondition for, shim/MOK trust of a third-party kernel module.
-
Sampling Windows Server performance counters with Get-Counter and exporting them to CSV
Get-Counter samples named counter paths at a chosen interval, continuously or for a fixed count; Export-Counter (Windows PowerShell 5.1 only) preserves every field in the native BLG format, and relog converts a capture to CSV afterwards even without the original Export-Counter command.
-
Windows answer files (unattend.xml): configuration passes and where Setup looks for them
An unattend.xml answer file supplies settings to specific configuration passes of Windows Setup — windowsPE, generalize, specialize and oobeSystem are the ones provisioning touches most. Setup finds the file through a fixed implicit search order and caches it in %WINDIR%\Panther, and Windows System Image Manager builds these files and can hide, but not encrypt, local-account passwords in them.
-
Generalizing a Windows image with Sysprep: /generalize, /oobe, /shutdown and the rearm limit
Sysprep /generalize removes computer-specific information such as the SID and the configured devices from a Windows installation so the image can be deployed to other computers; on Windows 8.1/Server 2012 and later Sysprep can be run up to 1001 times per image (3 times on Windows 7/Server 2008 R2), and generalize failures leave their trace in the Panther logs under System32\Sysprep.
-
Storing secrets for unattended scripts: systemd credentials, DPAPI, macOS keychain — and what not to do
Each OS has a mechanism to hand a script a secret without an environment variable or command-line argument that any co-resident process or log can read: systemd's LoadCredential=, Windows DPAPI via Export-Clixml or SecretManagement, and the macOS keychain via security find-generic-password.
-
Why NTP still runs inside virtual machines despite guest agents and paravirtual clocks
Virtual machines get time-related help from several layers — kvm-clock, guest agents, Hyper-V integration services — but none of them substitute for an NTP or chrony client running inside the guest. This article explains what each layer actually does and why time sync stays a guest-OS responsibility.
-
Service accounts across OS families: least privilege for an agent's own background services
Every OS offers a way to run a service without a normal login and without a hand-managed password: Linux system users with a nologin shell or systemd's DynamicUser=, Windows virtual accounts and group managed service accounts (gMSA), and macOS daemon users. Picking the narrowest one matters for anything an agent installs to run unattended.
-
Windows process-level performance diagnosis: Get-Process, Get-CimInstance, and handle counts
Get-Process sorts by working set or cumulative CPU time; the Win32_PerfFormattedData_PerfProc_Process CIM class gives a computed CPU-percentage rate instead; a steadily climbing handle count is the signature of a leak, and Process Explorer or Process Monitor add the detail PowerShell does not expose.
-
Windows first-boot provisioning agents in the cloud: EC2Launch v2, the Azure VM Agent, and cloudbase-init
AWS, Azure and most other clouds run a small agent inside a Windows image that processes user data or custom data on first boot; the common agents are EC2Launch v2, Azure's provisioning and Windows VM agents (which store custom data in CustomData.bin but do not execute it) and the open-source cloudbase-init. Each logs to a different location worth checking when provisioning appears to have silently failed.
-
Trusting a private CA on macOS and Windows, and verifying it actually took effect
macOS trusts a root CA system-wide through the System keychain with `security add-trusted-cert`, and Windows through the Local Machine Root store with Import-Certificate or certutil -addstore. Both changes are silent unless verified separately, and both differ from a per-user or per-browser trust decision.
-
Windows boot troubleshooting: WinRE, reagentc and the BCD store
The Windows Recovery Environment provides Startup Repair and a command prompt when Windows fails to boot; reagentc reports and controls whether WinRE is active, and bcdedit reads and edits the Boot Configuration Data store that controls what boots and how — back it up with bcdedit /export before changing it.
Legível por máquina: JSON